图的对抗性学习概况
概述:
图上的深度学习模型在各种图分析任务(例如节点分类,链接预测和图聚类)中均取得了卓越的性能。但是,它们暴露了对设计良好的输入(即对抗性样本)的不确定性和不可靠性。因此,针对不同图分析任务中的攻击和防御都出现了各种研究,从而导致了图对抗学习中的军备竞赛。例如,攻击者具有中毒和逃避攻击,防御小组相应地具有基于预处理和对抗的方法。
论文:
A Survey of Adversarial Learning on Graph
原链接:
https://github.com/gitgiter/Graph-Adversarial-Learning
Attack Type (Incoming)
-
- [1] Transferring Robustness for Graph Neural Network Against Poisoning Attacks
- [2] Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing
- [3] Power Up! Robust Graph Convolutional Network Against Evasion Attacks Based on Graph Powering
- [4] How Robust Are Graph Neural Networks to Structural Noise?
- [5] All You Need is Low (Rank): Defending Against Adversarial Attacks on Graphs
- [6] Certifiable Robustness and Robust Training for Graph Convolutional Networks
- [7] Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
- [8] Adversarial Examples on Graph Data: Deep Insights Into Attack and Defense
- [9] Adversarial Defense Framework for Graph Neural Network
- [10] Investigating Robustness and Interpretability of Link Prediction via Adversarial Modifications
- [11] Robust Graph Convolutional Networks Against Adversarial Attacks
- [12] Can Adversarial Network Attack Be Defended?
- [13] Virtual Adversarial Training on Graph Convolutional Networks in Node Classification
- [14] Comparing and Detecting Adversarial Attacks for Graph Deep Learning
- [15] Graph Adversarial Training: Dynamically Regularizing Based on Graph Structure
- [16] Characterizing Malicious Edges Targeting on Graph Neural Networks
- [17] Batch Virtual Adversarial Training for Graph Convolutional Networks
- [18] GraphDefense: Towards Robust Graph Convolutional Networks
- [19] αcyber: Enhancing Robustness of Android Malware Detection System against Adversarial Attacks on Heterogeneous Graph based Model
- [20] Edge Dithering for Robust Adaptive Graph Convolutional Networks
- [21] GraphSAC: Detecting Anomalies in Large-scale Graphs
- [22] Certifiable Robustness to Graph Perturbations
- [23] Adversarial Robustness of Similarity-Based Link Prediction
- [24] Improving Robustness to Attacks Against Vertex Classification
- [25] Adversarial Personalized Ranking for Recommendation
Attack
Venue | Title | Model | Algorithm | Target Task | Target Model | Baseline | Metric | Dataset | Code |
---|---|---|---|---|---|---|---|---|---|
Arxiv 2020 | [1] 🔙 | MGA | Gradient-based GCN | Node Classification, Community Detection | GCN, DeepWalk, Node2vec, GraphGAN, LPA, Louvain | GradArgmax, RL-S2V, Nettack, FGA | ASR, AML | Cora, Citeseer, Polblogs, Dolphin, PloBook | - |
Arxiv 2020 | [2] 🔙 | RLR, DALR, DILR | Random, Degree | Network Structure | Physical Criteria | - | △M (AML), △L, △C ,△D | Generated simplex networks | - |
Arxiv 2020 | [3] 🔙 | GUA | Anchors identified (based on GCN) | Node Classification | GCN, DeepWalk, Node2Vec, GAT | Random, VCA, FGA | AML, ASR | Cora, Citeseer, Polblogs, | - |
WWW 2020 | [4] 🔙 | CD-ATTACK | Graph generation based on GCN | Community Detection | GCN, Node2vec + K-means, ComE | DICE, MBA, RTA | Hiding performance measure M1 & M2 | DBLP, Finance | Link |
AAMAS 2020 | [5] 🔙 | FPTA | - | Node Similarity | Node Similarity Measures | Random, Greedy, High Jaccard Similarity (HJ) | Time, AML | Barabasi-Albert (BA), Erdos-Renyi (ER) | |
Arxiv 2019 | [6] 🔙 | NIPA | Reinforcement learning, Nodes injection | Node Classification | GCN | Random, Nettack, RL-S2V, FGA, Preferential attack | Accuracy | Cora-ML, Citeseer, Pubmed | - |
NIPS 2019 | [7] 🔙 | G-SSL | Gradient based asymptotic linear algorithm | Classification, Regression | Label propagation & regularization algs | Random, PageRank, Degree | Error rate, RMSE | cadata, E2006, mnist17, rcv1 | Link |
AAAI 2020 | [8] 🔙 | GF-Attack | Graph signal processing | Node Classification | GCN, SGC, DeepWalk, LINE | Random, Degree, RL-S2V, | Accuracy | Cora, CiteSeer, Pubmed | Link |
Arxiv 2019 | [9] 🔙 | IG-FGSM, IG-JSMA | Gradient-based GCN | Node Classification | GCN | FGSM, JSMA, Nettack | Classification Margin, Accuracy | Cora, CiteSeer, PolBlogs | - |
Arxiv 2019 | [10] 🔙 | EPA | Genetic algorithm | Community Detection | GRE, INF, LOU | NMI, ARI | Synthetic networks, Football, Email, Polblogs | - | |
ICLR 2019 | [11] 🔙 | Meta-Self Meta-Train | Gradient-based GCN | Node Classification | GCN, CLN, DeepWalk | DICE, Nettack, First-order | Misclassification Rate, Accuracy | Cora, CiteSeer, PolBlogs, PubMed | Link |
ICML 2019 | [12] 🔙 | Gradient- based random walk | Node Classification, Link Prediction | DeepWalk | F1 Score, Classification Margin | Cora, Citeseer, PolBlogs | Link | ||
Arxiv 2019 | [13] 🔙 | TGA-Tra, TGA-Gre | Gradient-based DDNE | Link Prediction | DDNE, ctRBM, GTRBM, dynAERNN | Random, DGA, CNA | ASR, AML | RADOSLAW, LKML, FB-WOSN | - |
Arxiv 2019 | [14] 🔙 | ReWatt | Reinforcement learning based on GCN | Graph Classification | GCN | RL-S2V, RA | ASR | REDDIT-MULTI-12K, REDDIT-MULTI-5K, IMDB-MULTI | - |
IJCAI 2019 | [15] 🔙 | PGD Min-Max | Gradient-based GCN | Node Classification | GCN | DICE, Meta-Self, Greedy | Misclassification Rate | Cora, Citeseer | Link |
Arxiv 2019 | [16] 🔙 | EDA | Genetic algorithm based on DeepWalk | Node Classification, Community Detection | HOPE, LPA, EM, DeepWalk | Random, DICE, RLS, DBA | NMI, Micro-F1, Macro-F1 | Karate, Game, Dolphin | - |
Arxiv 2019 | [17] 🔙 | DAGAER | Generative model based on VGAE | Node Classification | GCN | Nettack | ASR | Cora CiteSeer | - |
IJCAI 2019 | [18] 🔙 | - | Knowledge embedding | Fact Plausibility Prediction | TransE, TransR, RESCAL | RA | MRR, HR@K | FB15k, WN18 | - |
CCS 2019 | [19] 🔙 | - | Based on LinLBP | Node Classification, Evasion | LinLBP, JWP, LBP, RW, LINE, DeepWalk, Node2vec, GCN | Random, Nettack | FNR, FPR | Facebook, Enron, Epinions, Twitter, Google+ | - |
TCSS 2019 | [20] 🔙 | Q-Attack | Genetic algorithm | Community Detection | FN, Lou, SOA, LPA, INF, Node2vec+KM | Random, CDA, DBA | Modularity Q, NMI | Karate, Dolphins, Football, Polbooks | - |
CIKM 2019 | [21] 🔙 | HG-Attack | Label propagation algorithm Nodes injection | Malware Detection | Orig-HGC | AN-Attack | TP, TN, FP, FN, F1, Precision, Recall, Accuracy | Tencent Security Lab Dataset | - |
Arxiv 2019 | [22] 🔙 | UNAttack | Gradient-based similarity method, Nodes injection | Recommendation | Memory-based CF, BPRMF, NCF | - | Hit@K | Filmtrust, Movielens, Amazon | - |
Arxiv 2018 | [23] 🔙 | - | Gradient-based GAN, MF Nodes injection | Recommendation | MF | Random, Average, Popular, Co-visitation | Attack Difference, TVD, JS, Est., Rank Loss @K, Adversarial loss | Movielens 100K, Movielens 1M | - |
Arxiv 2018 | [24] 🔙 | Greedy, Greedy GAN | Gradient-based GCN, GAN | Node Classification | GCN | RA | Accuracy, F1 Score, ASR | Cora, Citeseer | - |
Arxiv 2018 | [25] 🔙 | CTR OTC | Neighbour score based on graph structure | Link Prediction | Traditional Link Prediction Algs | - | AUC, AP | WTC 9/11, ScaleFree, Facebook, Random network | - |
Arxiv 2018 | [26] 🔙 | IGA | Gradient-based GAE | Link Prediction | GAE, LRW DeepWalk, Node2vec, CN, RA, Katz | RAN, DICE, GA | ASR , AML | NS, Yeast, | - |
ICML 2018 | [27] 🔙 | RL-S2V | Reinforcement learning | Node/Graph Classification | GCN, GNN | Random | Accuracy | Citeseer, Cora, Pubmed, Finance | Link |
KDD 2018 | [28] 🔙 | Nettack | Greedy search & gradient based on GCN | Node Classification | GCN, CLN, DeepWalk | Rnd, FGSM | Classification Margin, Accuracy | Cora-ML, Citeseer, PolBlogs | Link |
Arxiv 2018 | [29] 🔙 | FGA | Gradient-based GCN | Node Classification, Community Detection | GCN, GraRep, DeepWalk, Node2vec, LINE, GraphGAN | Random, DICE, Nettack | ASR, AML | Cora, Citeseer, PolBlogs | - |
Arxiv 2018 | [30] 🔙 | Opt-attack | Gradient based on DeepWalk, LINE | Link Prediction | DeepWalk LINE Node2vec SC GAE | Random, PageRank, Degree sum, Shortest path | Similarity Score AP | Facebook, Cora, Citeseer | - |
AAMAS 2018 | [31] 🔙 | Approx-Local | Similarity methods | Link Prediction | Local&Global similarity metrics | Random, GreedyBase | Katz Similarity, ACT Distance, Similarity Score | Random network, | - |
CCS 2017 | [32] 🔙 | Targeted noise injection, Small community attack | Noise injection | Graph Clustering, Community Detection | SVD, Node2vec, Community Detection Algs | - | ASR, FPR | Reverse Engineered DGA Domains, NXDOMAIN | - |
Defense
Venue | Title | Model | Algorithm | Defense Type | Target Task | Target Model | Baseline | Metric | Dataset | Code |
---|---|---|---|---|---|---|---|---|---|---|
WSDM 2020 | [1] 🔙 | PA-GNN | Penalized Aggregation, Meta Learning | Structure Based | Node Classification | GNN | GCN, GAT, PreProcess, RGCN, VPN | Accuracy | Pubmed, Reddit, Yelp | - |
WWW 2020 | [2] 🔙 | - | Robustness Certification | Hybrid | Community detection | - | - | certified accuracy | Email,DBLP,Amazon | |
ICLR 2020 OpenReview | [3] 🔙 | r-GCN, VPN | Graph Powering | Objective Based | Node Classification | GCN | ManiReg, SemiEmb, LP, DeepWalk, ICA, Planetoid, Vanilla GCN | Accuracy, Robustness Merit, Attack Deterioration | Citeseer, Cora, Pubmed | - |
Arxiv 2019 | [4] 🔙 | - | Adversarial Training | Adversarial Training | Node Classification | GIN | GIN(without agumented data) | F1 score | ||
WSDM 2019 | [5] 🔙 | |||||||||
KDD 2019 | [6] 🔙 | GNN (trained with RH-U) | Robustness Certification, Objective Based | Hybrid | Node Classification | GNN, GCN | GNN (trained with CE, RCE, RH) | Accuracy, Averaged Worst-case Margin | Citeseer, Cora-ML, Pubmed | Link |
IJCAI 2019 | [7] 🔙 | - | Adversarial Training | Adversarial Training | Node Classification | GCN | GCN | Misclassification Rate Accuracy | Citeseer, Cora | Link |
IJCAI 2019 | [8] 🔙 | - | Drop Edges | Preprocessing | Node Classification | GCN | GCN | Classfication Margin, Accuracy | Cora-ML, Citeseer, PolBlogs | Link |
Arxiv 2019 | [9] 🔙 | DefNet | GAN, GER, ACL | Hybrid | Node Classification | GCN, GraphSAGE | GCN, GraphSage | Classfication Margin | Cora, Citeseer, PolBlogs | - |
NAACL 2019 | [10] 🔙 | CRIAGE | Adversarial Modification | Robustness Evaluation | Link Prediction | Knowledge Graph Embedding | - | Hits@K, MRR | Nations, Kinship, WN18, YAGO3-10 | - |
KDD 2019 | [11] 🔙 | RGCN | Gaussian-based Graph Convolution | Structure Based | Node Classification | GCN | GCN, GAT | Accuracy | Cora, Citeseer, Pubmed | Link |
Arxiv 2019 | [12] 🔙 | Global-AT, Target-AT, SD, SCEL | Adversarial Training, Smooth Defense | Hybrid | Node Classification | GNN | AT | ADR, ACD | PolBlogs, Cora, Citeseer | - |
PRCV 2019 | [13] 🔙 | SVAT, DVAT | Virtual Adversarial Training | Adversarial Training | Node Classification | GCN | GCN | Accuracy | Cora, Citeseer, Pubmed | - |
RLGM@ICLR 2019 | [14] 🔙 | - | KL Divergence | Detection Based | Node Classification | GCN, GAT | - | Classfication Margin, Accuracy, ROC, AUC | Cora, Citeseer, PolBlogs | - |
Arxiv 2019 | [15] 🔙 | GCN-GATV | Graph Adversarial Training, Virtual Adversarial Training | Adversarial Training | Node Classification | GCN | LP, DeepWalk, SemiEmb, Planetoid, GCN, GraphSGAN | Accuracy | Citeseer, Cora, NELL | - |
ICLR 2019 OpenReview | [16] 🔙 | SL, OD, GGD, LP+GGD, ENS | Link Prediction, Subsampling, Neighbour Analysis | Hybrid | Node Classification | GNN, GCN | LP | AUC | Cora, Citeseer | - |
ICML 2019 | [17] 🔙 | S-BVAT, O-BVAT | Batch Virtual Adversarial Training | Adversarial Training | Node Classification | GCN | ManiReg, SemiEmb, LP, DeepWalk, Planetoid, Monet, GAT, GPNN, GCN, VAT | Accuracy | Cora, Citeseer, Pubmed, Nell | Link |
Arxiv 2019 | [18] 🔙 | GraphDefense | Adversarial Training | Adversarial Training | Node Classification | GCN | Drop Edges, Discrete Adversarial Training | Accuracy | Cora, Citeseer, Reddit | - |
CIKM 2019 | [19] 🔙 | Rad-HGC | HG-Defense | Detection Based | Malware Detection | Malware Detection System | FakeBank, CryptoMiner, AppCracked, MalFlayer, GameTrojan, BlackBaby, SDKSmartPush, ... | Detection Rate | Tencent Security Lab Dataset | - |
Arxiv 2019 | [20] 🔙 | AGCN | Adaptive GCN with Edge Dithering | Structure Based | Node Classification | GCN | GCN | Accuracy | Citeseer, PolBlogs, Cora, Pubmed | - |
Arxiv 2019 | [21] 🔙 | GraphSVC | Random, Consensus | Detection Based | Anomaly Detection | Anomaly Model | GAE, Amen, Radar, Degree, Cut ratio, Flake, Conductance | AUC | Citeseer, PolBlogs, Cora, Pubmed | - |
NIPS 2019 | [22] 🔙 | GNN (train with | Robustness Certification, Objective Based | Hybrid | Node Classification | GNN | GNN | Accuracy, Worst-case Margin | Cora-ML, Citeseer, Pubmed | link |
ICDM 2019 | [23] 🔙 | IDOpt, IDRank | Integer Program, Edge Ranking | Heuristic Algorithm | Link Prediction | Similarity-based Link Prediction Models | PPN | DPR | PA, PLD, TVShow, Gov | - |
MLG@KDD 2019 | [24] 🔙 | SVM with a radial basis function kernel | Augmented Feature, Edge Selecting | Hybrid | Node Classification | SVM | GCN | Classification Marigin | Cora, Citeseer | - |
SIGIR 2018 | [25] 🔙 | APR, AMF | Adversarial Training based on MF-BPR | Adversarial Training | Recommendation | MF-BPR | ItemPop, MF-BPR, CDAE, NeuMF, IRGAN | HR, NDCG | Yelp, Pinterest, Gowalla | Link |
Baselines
@misc{chen2020survey,
title={A Survey of Adversarial Learning on Graphs},
author={Liang Chen and Jintang Li and Jiaying Peng and Tao Xie and Zengxu Cao and Kun Xu and Xiangnan He and Zibin Zheng},
year={2020},
eprint={2003.05730},
archivePrefix={arXiv},
primaryClass={cs.LG}
}